CVE-2024-43442: otrs ag otrs Improper Filtering of Special Elements

Vulnerability summary

CVE-2024-43442 is a medium (CVSS 4.9) Improper Filtering of Special Elements vulnerability in otrs ag otrs. EPSS estimates a 0.40% chance of exploitation in the next 30 days, higher than 33.2% of scored vulnerabilities.

Timeline

1. 26-08-2024
   PublishedVulnerability first disclosed.
2. 26-08-2024
   Last modifiedVulnerability information updated.

Description

Improper Neutralization of Input done by an attacker with admin privileges ('Cross-site Scripting') in  OTRS (System Configuration modules) and ((OTRS)) Community Edition allows Cross-Site Scripting (XSS) within the System Configuration targeting other admins. This issue affects: * OTRS from 7.0.X through 7.0.50 * OTRS 8.0.X * OTRS 2023.X * OTRS from 2024.X through 2024.5.X * ((OTRS)) Community Edition: 6.0.x Products based on the ((OTRS)) Community Edition also very likely to be affected

• CWE-790Improper Filtering of Special ElementsThe product receives data from an upstream component, but does not filter or incorrectly filters special elements before sending it to a downstream component.
• CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.